As for the MO - the lulz, would be my guess. Googling it (http://www.google.com/search?gcx=w&ix=c2&sourceid=chrome&ie=UTF-8&q=%22---%3D%3D%5B%7CHacked+By+Toxic+

As for the MO - the lulz, would be my guess. Googling it (http://www.google.com/search?gcx=w&ix=c2&sourceid=chrome&ie=UTF-8&q=%22---%3D%3D%5B%7CHacked+By+Toxic+H4ck3R%7C%5D%3D%3D---%22 http://www.google.com/search?gcx=w&ix=c2&sourceid=ch...) shows that who ever is doing it is widely indiscriminatory with who they are hacking. As for how they did it, it really depends on the infrastructure in place already. If you are using any cms (wordpress, drupal) it was likely through that, as there are a number of weaknesses published regularly that are used against it. The first thing to do is check current index to see who wrote to it last, and at what time. If it is the webuser (ie apache, nginx, etc) then it was almost certainly a hack from a browser, if it was root, the server has been compromised. Once you have the file's update time, you should look over your access logs to see if there is anything suspicious lines up that time. As for the cleanup, assuming you are using a linux based server and it was compromised, install rkhunter, run it right away. This should catch anything that they would have used (it seems like a scriptkiddy), change any access port, update your ssh password and change the port, and preferably change over to a key based login system (http://pkeck.myweb.uga.edu/ssh/ http://pkeck.myweb.uga.edu/ssh/). I would also look into fail2ban (fail2ban.org) if they did bruteforce, as it would have stopped them. As a cherry ontop, you can setup a basic mail script to send yourself a text/email whenver anyone logs into root/any important account. If you want any help, I used to do this sort of cleanup as a job, and I have a free afternoon. DM me.